1

Why doesn't RHEL server ask for a password in single user mode? Red Hat Enterprise Linux Server release 6.6 (Santiago), in case it's relevant.

I had many cases where I had to reset root password in single user mode, I tried to figure out why system does not ask password in single user mode ( Run level 1).

  • Red Hat Enterprise Linux Server release 6.6 (Santiago) – chaitanya gudur Oct 24 '18 at 19:05
  • @JeffSchaller I don't think that's a duplicate because RHEL 7 is based on systemd but RHEL 6.6 isn't. (AFAIK.) – roaima Oct 24 '18 at 19:10
  • thanks for the comment @christopher, I just want to know the logic behind why root password is not need when we use single user mode ( run level 1) – chaitanya gudur Oct 24 '18 at 19:12
  • 3
    Well traditionally single-user would mean no network and no remote or terminal log-ins. The only active terminal would be "the console" - the one terminal directly hooked-up to the computer - usually located in a locked computer-room with access to only a select few. In such an enviroment, it probably didn't matter so much if there were no password - especially since it usually would require the root-password to take the system to single-user in the first place. – Baard Kopperud Oct 24 '18 at 19:17
4

To check if authentication is required for single-user mode:

grep SINGLE /etc/sysconfig/init

The output should be as follows if authentication is required.

SINGLE=/sbin/sulogin

By default, no authentication is performed if single-user mode is selected. To require entry of the root password in single-user mode, add or correct the following line in the file /etc/sysconfig/init.

SINGLE=/sbin/sulogin

Why? I can only guess. Perhaps it is assumed that the machine is physically secure.

As @JeffSchaller points out, the current value of SINGLE is likely /sbin/sushell.

To incorporate a good comment by @BaardKopperud as well, to try to keep it from getting buried in comments...

Well traditionally single-user would mean no network and no remote or terminal log-ins. The only active terminal would be "the console" - the one terminal directly hooked-up to the computer - usually located in a locked computer-room with access to only a select few. In such an enviroment, it probably didn't matter so much if there were no password - especially since it usually would require the root-password to take the system to single-user in the first place.

  • Anyone who has physical access and can boot the system to single user mode can just as easily boot it into init=/bin/sh and bypass all authentication that way, so there's no point in asking for a password. – Shadur Oct 25 '18 at 4:42
4

Because there's actually no point in most cases.

If the system is not physically secured and does not have boot access locked down properly, you don't even need to use single user mode to do things you would normally use it for, you can just boot some other OS on the system and do the same things.

If the system is physically secured (regardless of whether boot access is locked down or not), then you realistically don't need a password, because anybody who could get to the system to use single-user mode already has access to the system via other means, and doesn't need single-user mode (IOW, being able to pass the physical security checks is sufficient authorization for access to single user mode).

The only time it is potentially helpful is if the system is not physically secured, but you have the boot sequence locked down such that people can't boot alternate operating systems on the device. However, such a situation actually isn't very common outside of big enterprise settings (the same type of setting where you would run Windows systems with the main user no having admin access to the system), and it's not hard for them to just enable password protection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.